Eurofiber France confirms breach; actor claims data on 10,000 clients
Eurofiber France confirmed a breach caused by a flaw in its ticketing system and cloud customer portal. An actor calling itself ByteToBreach claims data on about 10,000 business clients, including credentials, VPN configuration files and certificates, and is reportedly trying to extort the company. The flaw is patched and the incident was reported to CNIL and ANSSI; clients should rotate credentials, revoke certificates and review VPN access.
What happened
Eurofiber France, the French arm of the European fiber network operator, confirmed a breach via a flaw in its ticketing system and cloud customer portal. An actor calling itself ByteToBreach claims data on about 10,000 business clients of the Eurafibre, FullSave, Netiwan and Avelia brands, and is reportedly trying to extort the company. The flaw is patched and the incident was reported to CNIL and ANSSI.
Why it matters
Per the actor's claim, stolen data includes credentials, VPN configuration files, certificates, source code, screenshots, email archives and SQL backups. These items can open doors into business customers' networks. The stolen-data list comes from the actor and is not verified.
What to do
Business clients should rotate exposed credentials, revoke certificates and review VPN configurations and access now.
For the technical team
- Affected
- Eurofiber France Sistema de chamados e portal de nuvem para clientes da Eurofiber France, incluindo as marcas Eurafibre, FullSave, Netiwa · Eurofiber France's ticketing system and cloud customer portal, including the Eurafibre, FullSave, Netiwan and Avelia brands. Specific versions were not cited.
- Exploitation
- Breach confirmed by the company. An actor calling itself ByteToBreach claims the attack, alleges theft of data on about 10,000 business clients and, per DailyDarkWeb, is reportedly trying to extort the company. The stolen-data list is unverified.
- Fix
- The flaw is patched, per the report. No specific versions, patches or CVE were cited in the sources. The incident was reported to CNIL and ANSSI.
- Vector
- Entry point: a flaw in Eurofiber France's ticketing system, together with its cloud customer portal. Technical details of the flaw were not disclosed in the sources.
- More details
- Data allegedly stolen by the actor: screenshots, VPN configuration files, credentials, source code, certificates, email archives and SQL backups. Single source: DailyDarkWeb post on X. No dates, CVE, versions or technical indicators in the sources.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
